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We Claim: 

1. A method for use in a system which includes a cryptographic 
key store for storing a transformed cryptographic key and accessing 
circuitry for accessing the transformed cryptographic key from the 
cryptographic key store, the method comprising the step of: 

storing key re-transforming information for the transformed 
cryptographic key in a decryption store, the accessing circuitry being able 
to communicate with the decryption store exclusively via a predetermined 
interface, the interface being such that the accessing circuitry is unable 
to access from the decryption store at least one of: a) at least a portion of 
the key re-transforming information, and b) at least a portion of the 
cryptographic key. 

2. The method of claim 1 wherein the interface is such that the 
accessing circuitry is unable to access from the decryption store both of: 
a) at least a portion of the key re-transforming information, and b) at 
least a portion of the cryptographic key. 

3. The method of claim 1 wherein the key re-transforming 
information comprises: 

a transformation pattern; and 
a key decrypting algorithm. 

4. The method of claim 3 wherein the transformation pattern 
comprises a unique identifier of the decryption store. 

5. The method of claim 1 further comprising the steps of: 
the decryption store receiving the cryptographic key; 
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3 the decryption store transforming the cryptographic key using key 

4 transforming information to produce the transformed cryptographic key; 

5 and 

6 the decryption store sending the transformed cryptographic key to 

7 the cryptographic key store. 



1 6. The method of claim 1 wherein: 

2 the decryption store comprises a mobile terminal; 

3 the cryptographic key store comprises a computer memory; and 

4 the accessing circuitry comprises a processor. 

1 7. The method of claim 1 wherein: 

2 the decryption store comprises a network access card; 

3 the cryptographic key store comprises a computer memory; and 

4 the accessing circuitry comprises a processor. 

1 8. The method of claim 1 further comprising the steps of: 

2 the decryption store receiving the transformed cryptographic key 

3 and information; 

4 the decryption store re-transforming the transformed cryptographic 

5 key using the key re-transforming information to produce the 

6 cryptographic key; and 

7 the decryption store encrypting the information using the 

8 cryptographic key to produce encrypted information. 

1 9. The method of claim 8 further comprising the step of 

2 transmitting the encrypted information. 
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1 10. The method of claim 1 further comprising the steps of: 

2 the decryption store receiving encrypted information; 

3 the decryption store receiving the transformed cryptographic key; 

4 the decryption store re-transforming the transformed cryptographic 

5 key using key re-transforming information to produce the cryptographic 

6 key; and 

7 the decryption store decrypting the encrypted information using the 

8 cryptographic key to produce decrypted information. 

1 11. The method of claim 10 further comprising the step of the 

2 accessing circuitry accessing the decrypted information. 

1 12. The method of claim 1 wherein the accessing circuitry's 

2 communication with the decryption store comprises the transfer of 

3 information between them. 

1 13. The method of claim 1 wherein the storing step comprises 

2 storing the transformed cryptographic key in the cryptographic key store 

3 for a period of time . 

1 14. The method of claim 1 further comprising the step of erasing 

2 the cryptographic key from the decryption store at the completion of each 

3 cryptographic operation. 

1 15. The method of claim 1 wherein the cryptographic key is stored 

2 in the decryption store in such a way that it disappears from the 

3 decryption store when the decryption store is removed from the system. 

l 16. A system comprising: 
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2 a cryptographic key store for storing a transformed cryptographic 

3 key; 

4 a decryption store for storing key re-transforming information for 

5 the transformed cryptographic key, the decryption store having a 

6 predetermined interface; 

7 accessing circuitry coupled to the cryptographic key store , the 



8 accessing circuitry being able to access the transformed cryptographic 

9 key in the cryptographic key store, and to communicate with the 
10 decryption store exclusively via the predetermined interface, the interface 
n being such that the accessing circuitry is unable to access from the 
12 decryption store at least one of: a) at least a portion of the key re- 

*Sl3 transforming information, and b) at least a portion of the cryptographic 

Si 4 key. 



-Si 17. The method of claim 16 wherein interface is such that the 

I, 2 accessing circuitry is unable to access from the decryption store both of: 

I j 3 a) at least a portion of the key re-transforming information, and b) at 

^ 4 least a portion of the cryptographic key. 

1 18. The system of claim 16 wherein: 

2 the decryption store comprises a mobile terminal; 

3 the cryptographic key store comprises a computer memory; and 

4 the accessing circuitry comprises a processor. 

1 19. The system of claim 16 wherein: 

2 the decryption store comprises a network access card; 

3 the cryptographic key store comprises a computer memory; and 

4 the accessing circuitry comprises a processor. 
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1 20. The system of claim 16 wherein the decryption store further 

2 comprises: 

3 an input port for receiving the transformed cryptographic key; 

4 a key decrypting module for decrypting the transformed 

5 cryptographic key using the key re-transforming information to produce 

6 the cryptographic key; 

7 an encrypting module for encrypting information using the 

8 cryptographic key to produce encrypted information. 

1 21. The system of claim 20 wherein the decryption store further 

2 comprises a transmitter for transmitting the encrypted information. 



1 22. The system of claim 16 wherein the decryption store further 

2 comprises: 

3 an input port for receiving the transformed cryptographic key; 

4 a key decrypting module for decrypting the transformed 

5 cryptographic key using the key re-transforming information to produce 

6 the cryptographic key; 

7 a decrypting module for decrypting encrypted information. 

1 23. The system of claim 22 wherein the decryption store further 

2 comprises a receiver for receiving the encrypted information. 

1 24. The system of claim 16 wherein the decryption store further 

2 comprises: 

3 a receiver for receiving the cryptographic key; 
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4 a key encrypting module for encrypting the cryptographic key using 

5 key transforming information to produce the transformed cryptographic 

6 key; and 

7 an output port for outputting the transformed cryptographic key. 

1 25. A decryption store for storing key re-transforming information 

2 for a transformed cryptographic key, the decryption store comprising: 

3 a predetermined interface, the interface being operable to receive 

4 the transformed cryptographic key; and 

5 an output port complying exclusively with the predetermined 

6 interface such that information is accessible from the decryption store 
-;: 7 through the output port; 

JO 8 wherein at least one of: a) at least a portion of the key re- 

l:J 9 transforming information, and b) at least a portion of the cryptographic 

3o key being not accessible from the decryption store through the output 

°j*u port. 

- J 1 26. The method of claim 25 wherein interface is such that at least 

O 2 both of: a) at least a portion of the key re-transforming information, and 

3 b) at least a portion of the cryptographic key are not accessible from the 

4 decryption store through the output port. 

1 27. The invention of claim 25 wherein the decryption store 

2 comprises a mobile terminal. 

1 28. The invention of claim 25 wherein the decryption store 

2 comprises a network access card. 
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1 29. The invention of claim 25 wherein the decryption store further 

2 comprises: 

3 a key decrypting module for decrypting the transformed 

4 cryptographic key using the key re-transforming information to produce 

5 the cryptographic key; 

6 an encrypting module for encrypting information using the 

7 cryptographic key to produce encrypted information; and 

8 a decrypting module for decrypting encrypted information. 

1 30. The invention of claim 29 wherein the decryption store further 

2 comprises a transmitter for transmitting the encrypted information. 

1 31. The invention of claim 25 wherein the decryption store further 

2 comprises: 

3 a receiver for receiving the cryptographic key; 

4 a key encrypting module for encrypting the cryptographic key using 

5 key transforming information to produce the transformed cryptographic 

6 key. 

1 32. The invention of claim 31 wherein the transformed 

2 cryptographic key is a function of a transformation pattern. 

1 33. The method of claim 32 wherein the transformation pattern 

2 comprises a unique identifier of the decryption store. 

1 34. A method for use in a decryption store having a predetermined 

2 interface and an output port complying exclusively with the interface 

3 such that information is accessible from the decryption store through the 

4 output port and at least one of: a) at least a portion of the key re- 
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5 transforming information, and b) at least a portion of the cryptographic 

6 key, is not accessible from the decryption store through the output port, 

7 the method comprising the step of: 

8 storing key re-transforming information for a transformed 

9 cryptographic key in the decryption store; 

10 receiving the transformed cryptographic key; and 

11 decrypting the transformed cryptographic key to produce the 

12 cryptographic key. 

1 35. The method of claim 34 wherein the interface is such that at 

2 least both of: a) at least a portion of the key re-transforming information, 
^ 3 and b) at least a portion of the cryptographic key are not accessible from 
5 4 the decryption store through the output port. 

,pi 36. The method of claim 34 wherein the key re-transforming 

^ 2 information comprises: 

H 3 a transformation pattern; and 

2 4 a key decrypting algorithm. 

1 37. The method of claim 36 wherein the transformation pattern 

2 comprises a unique identifier of the decryption store. 

1 38. The method of claim 34 further comprising the steps of: 

2 the decryption store receiving the cryptographic key; 

3 the decryption store transforming the cryptographic key using key 

4 transforming information to produce the transformed cryptographic key; 

5 and 

6 the decryption store sending the transformed cryptographic key to a 

7 cryptographic key store via the output port. 
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1 39. The method of claim 34 wherein the decryption store 

2 comprises a mobile terminal. 

1 40. The method of claim 34 wherein the decryption store 

2 comprises a network access card. 

1 41. The method of claim 34 further comprising the steps of: 

2 the decryption store receiving information; and 

3 the decryption store encrypting the information using the 

4 cryptographic key to produce encrypted information. 

1 42. The method of claim 41 further comprising the step of 

2 transmitting the encrypted information. 

1 43. The method of claim 34 further comprising the steps of: 

2 the decryption store receiving encrypted information; and 

3 the decryption store decrypting the information using the 

4 cryptographic key to produce decrypted information, 

1 44. The method of claim 43 further comprising the step of sending 

2 the decrypted information to accessing circuitry via the output port. 
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